Lucene search

GoogleOSV:BIT-GITLAB-2020-13317

HistoryMar 06, 2024 - 11:22 a.m.

BIT-gitlab-2020-13317

2024-03-0611:22:14

Google

osv.dev

vulnerability

gitlab

graphql

api

repository

deletion

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.5%

JSON

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a repository.

CPENameOperatorVersion
gitlabge13.2.0
gitlablt13.2.8
gitlablt13.1.10
gitlablt13.3.4
gitlabge13.1.0
gitlabge13.3.0

Name	Operator	Version
gitlab	ge	13.2.0
gitlab	lt	13.2.8
gitlab	lt	13.1.10
gitlab	lt	13.3.4
gitlab	ge	13.1.0
gitlab	ge	13.3.0

References

gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13317.json

gitlab.com/gitlab-org/gitlab/-/issues/215703

hackerone.com/reports/858671

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.5%

JSON

Related for OSV:BIT-GITLAB-2020-13317